This is the lowdown on CVE-2026-109618 and CVE-2026-109619, in addition to what web site homeowners and IT groups ought to do to remain secure – all in just a little greater than two minutes
26 Oct 2026
Final week, particulars emerged a few pair of essential vulnerabilities in PHP, a server-side scripting language generally utilized in internet improvement. The information prompted safety advisories from authorities businesses and despatched web site homeowners scrambling to use the patches, with some websites even going offline as a precaution. It is because on an unpatched server, an attacker can exploit the vulnerabilities to run their very own code with out logging in. As three out of 4 web sites globally are estimated to make use of PHP in some capability, its ubiquity helps create an setting ripe for abuse; certainly, preliminary makes an attempt to use the issues – found by AI and dubbed PHP2Shell – weren’t lengthy in coming.
This is what to find out about CVE-2026-109618 and CVE-2026-109619, in addition to what web site homeowners and IT groups ought to do to remain secure – all in just a little greater than two minutes.
For detailed mitigation steps and different info, check with the advisories issued by the PHP Mission, CISA, CERT-EU or NCSC.
Join with us on Fb, X, LinkedIn and Instagram.
